Azure Storage Blob Anonymous Access Enabled

Description

Detects when Azure storage account blob anonymous access is enabled at the account level or when container public access is configured. Enabling anonymous access allows unauthenticated users to read blob data and may lead to data exposure.

Query · python

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    azure_parse_json_string,
    extract_resource_name_from_id,
)

STORAGE_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE"
BLOB_SERVICES_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE"
CONTAINERS_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE"


def rule(event):
    if not azure_activity_success(event):
        return False

    operation = event.get("operationName", "").upper()
    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    properties = requestbody.get("properties", {})

    # Check for storage account level - allowBlobPublicAccess
    if operation == STORAGE_WRITE:
        return properties.get("allowBlobPublicAccess") is True

    # Check for blob service or container level - publicAccess
    if operation in [BLOB_SERVICES_WRITE, CONTAINERS_WRITE]:
        return properties.get("publicAccess") in ["Blob", "Container"]

    return False


def title(event):
    resource_id = event.get("resourceId", "")
    operation = event.get("operationName", "").upper()

    if operation == STORAGE_WRITE:
        storage_account = extract_resource_name_from_id(
            resource_id, "storageAccounts", default="<UNKNOWN_ACCOUNT>"
        )
        return f"Azure Storage Account anonymous blob access enabled on [{storage_account}]"

    # For container-level operations, try to extract container name
    container = extract_resource_name_from_id(
        resource_id, "containers", default="<UNKNOWN_CONTAINER>"
    )
    if container:
        storage_resource = container
    else:
        storage_resource = extract_resource_name_from_id(
            resource_id, "storageAccounts", default="<UNKNOWN_RESOURCE>"
        )

    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    resource_type = requestbody.get("properties", {}).get("publicAccess", "")
    return f"Azure Storage public access allowed on [{resource_type}] " f"for [{storage_resource}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    return context

Analyst notes

  1. Query Azure Monitor Activity logs for all storage account operations by the callerIpAddress in the 6 hours before and after this alert to identify if this is part of a broader configuration change
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for data access patterns or blob download events from the affected storage account in the 24 hours after this configuration change to identify potential data exposure
Raw source Azure Storage Blob Anonymous Access Enabled · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: azure_storage_blob_anonymous_access_enabled.py
RuleID: "Azure.MonitorActivity.StorageAccount.BlobAnonymousAccessEnabled"
DisplayName: "Azure Storage Blob Anonymous Access Enabled"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: High
Description: >
  Detects when Azure storage account blob anonymous access is enabled at the account level or when container public access is configured.
  Enabling anonymous access allows unauthenticated users to read blob data and may lead to data exposure.
Reports:
  MITRE ATT&CK:
    - TA0010:T1530 # Exfiltration: Data from Cloud Storage
Tags:
  - Exfiltration
  - Data from Cloud Storage
Runbook: |
  1. Query Azure Monitor Activity logs for all storage account operations by the callerIpAddress in the 6 hours before and after this alert to identify if this is part of a broader configuration change
  2. Check if the source IP is associated with known cloud providers, VPN services, or corporate network ranges using threat intelligence
  3. Search for data access patterns or blob download events from the affected storage account in the 24 hours after this configuration change to identify potential data exposure
Reference: https://hackingthe.cloud/azure/anonymous-blob-access/
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: Storage Account Anonymous Access Enabled
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "1.1.1.1",
        "location": "eastus",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "properties": {
          "requestbody": "{\"properties\":{\"allowBlobPublicAccess\":true}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Storage Account Anonymous Access Disabled
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T11:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/securestorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "2.2.2.2",
        "location": "eastus",
        "correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
        "properties": {
          "requestbody": "{\"properties\":{\"allowBlobPublicAccess\":false}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Container Public Access Set to Blob
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T12:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount/blobServices/default/containers/mycontainer",
        "operationName": "Microsoft.Storage/storageAccounts/blobServices/containers/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "3.3.3.3",
        "location": "eastus",
        "correlationId": "c3d4e5f6-a7b8-9012-cdef-444444444444",
        "properties": {
          "requestbody": "{\"properties\":{\"publicAccess\":\"Blob\"}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Container Public Access Set to Container
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T13:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount/blobServices/default/containers/publiccontainer",
        "operationName": "Microsoft.Storage/storageAccounts/blobServices/containers/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "4.4.4.4",
        "location": "westus",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-333333333333",
        "properties": {
          "requestbody": "{\"properties\":{\"publicAccess\":\"Container\"}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Container Public Access Set to None
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T14:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/securestorageaccount/blobServices/default/containers/privatecontainer",
        "operationName": "Microsoft.Storage/storageAccounts/blobServices/containers/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "5.5.5.5",
        "location": "eastus",
        "correlationId": "e5f6a7b8-c9d0-1234-ef01-222222222222",
        "properties": {
          "requestbody": "{\"properties\":{\"publicAccess\":\"None\"}}"
        },
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T16:00:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/mystorageaccount",
        "operationName": "Microsoft.Storage/storageAccounts/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "7.7.7.7",
        "location": "eastus",
        "correlationId": "a7b8c9d0-e1f2-3456-0123-567890123456",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }

# ------ paired body: azure_storage_blob_anonymous_access_enabled.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    azure_parse_json_string,
    extract_resource_name_from_id,
)

STORAGE_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/WRITE"
BLOB_SERVICES_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/WRITE"
CONTAINERS_WRITE = "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE"


def rule(event):
    if not azure_activity_success(event):
        return False

    operation = event.get("operationName", "").upper()
    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    properties = requestbody.get("properties", {})

    # Check for storage account level - allowBlobPublicAccess
    if operation == STORAGE_WRITE:
        return properties.get("allowBlobPublicAccess") is True

    # Check for blob service or container level - publicAccess
    if operation in [BLOB_SERVICES_WRITE, CONTAINERS_WRITE]:
        return properties.get("publicAccess") in ["Blob", "Container"]

    return False


def title(event):
    resource_id = event.get("resourceId", "")
    operation = event.get("operationName", "").upper()

    if operation == STORAGE_WRITE:
        storage_account = extract_resource_name_from_id(
            resource_id, "storageAccounts", default="<UNKNOWN_ACCOUNT>"
        )
        return f"Azure Storage Account anonymous blob access enabled on [{storage_account}]"

    # For container-level operations, try to extract container name
    container = extract_resource_name_from_id(
        resource_id, "containers", default="<UNKNOWN_CONTAINER>"
    )
    if container:
        storage_resource = container
    else:
        storage_resource = extract_resource_name_from_id(
            resource_id, "storageAccounts", default="<UNKNOWN_RESOURCE>"
        )

    requestbody = azure_parse_json_string(event.deep_get("properties", "requestbody", default=None))
    resource_type = requestbody.get("properties", {}).get("publicAccess", "")
    return f"Azure Storage public access allowed on [{resource_type}] " f"for [{storage_resource}]"


def alert_context(event):
    context = azure_activity_alert_context(event)
    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.